From 31b51a0e60489d294bd66e1cec70e79e8963fc4e Mon Sep 17 00:00:00 2001
From: Owen Griffin <owen.griffin@gmail.com>
Date: Tue, 28 Sep 2021 10:43:02 +0000
Subject: [PATCH] Allow multiple zone_ids to be used with Azure DNS

---
 dns_scripts/Azure-README.txt | 13 +++++++++----
 dns_scripts/dns_add_azure    | 22 ++++++++++++++++++++--
 dns_scripts/dns_del_azure    | 22 ++++++++++++++++++++--
 3 files changed, 49 insertions(+), 8 deletions(-)

diff --git a/dns_scripts/Azure-README.txt b/dns_scripts/Azure-README.txt
index d314463..a0dbdc4 100644
--- a/dns_scripts/Azure-README.txt
+++ b/dns_scripts/Azure-README.txt
@@ -6,16 +6,21 @@ Prerequisites:
 - Azure CLI tools installed - see https://docs.microsoft.com/en-us/cli/azure/install-azure-cli
 - Logged in with azure-cli - i.e. azure login
 
-The dns_add_azure and dns_del_azure scripts assume that the following
-environment variables are added to the configuration file:
+Ensure dns_add_azure and dns_del_azure scripts are called when the DNS is validated by modifying the .getssl.cfg:
+
+VALIDATE_VIA_DNS=true
+DNS_ADD_COMMAND=dns_scripts/dns_add_azure # n.b use valid path
+DNS_DEL_COMMAND=dns_scripts/dns_del_azure
+
+The dns_add_azure and dns_del_azure scripts assume that the following environment variables are added to the configuration file:
 
 - AZURE_RESOURCE_GROUP - the name of the resource group that contains the DNS zone 
-- AZURE_ZONE_ID - the name of the DNS zone 
+- AZURE_ZONE_ID - a comma-separated list of valid DNS zones. this allows the same certificate to be used across multiple top-level domains
 - AZURE_SUBSCRIPTION_ID - the name or ID of the subscription that AZURE_RESOURCE_GROUP is part of
 
 Each of these variables can be included in the .getssl.cfg, e.g:
 
 export AZURE_RESOURCE_GROUP=my-resource-group
-export AZURE_ZONE_ID=example.com
+export AZURE_ZONE_ID=example.com,anotherdomain.com
 export AZURE_SUBSCRIPTION_ID=my-azure-subscriptin 
 
diff --git a/dns_scripts/dns_add_azure b/dns_scripts/dns_add_azure
index bf2263d..3f0f666 100755
--- a/dns_scripts/dns_add_azure
+++ b/dns_scripts/dns_add_azure
@@ -16,7 +16,25 @@ if [[ -z "$AZURE_SUBSCRIPTION_ID" ]]; then
   exit 2
 fi
 
+# Determine which zone ID to use from AZURE_ZONE_IDs
+# Convert the comma-separated list of AZURE_ZONE_IDs into an array and loop
+IFS=',' read -ra zone_ids <<< "$AZURE_ZONE_ID"
+for item in "${zone_ids[@]}"; do 
+  # If the full domain ends with the current zone ID
+  [[ "$fulldomain" =~ .*"${item}"$ ]] && zone_id="$item"
+done
+
+if [ -z "$zone_id" ]; then 
+  echo "${fulldomain} does not match any of the zone IDs specified by ${AZURE_ZONE_ID[@]}"
+  exit 2
+fi
+
 az account set --subscription "$AZURE_SUBSCRIPTION_ID"
-recordset="_acme-challenge.${fulldomain/.$AZURE_ZONE_ID/}"
+# Determine the recordset by removing the zone_id from the full domain and prefixing
+# with _acme-challenge.
+recordset="_acme-challenge.${fulldomain/.$zone_id/}"
+# The fulldomain should not be included in the recordset. It is used for subdomains.
+# E.g. domain = *.sub.example.com the recordset is _acme-challenge.sub
+#      domain = example.com the record set is _acme-challenge
 [[ "$recordset" == "_acme-challenge.$fulldomain" ]] && recordset="_acme-challenge"
-az network dns record-set txt add-record -g "$AZURE_RESOURCE_GROUP" -z "$AZURE_ZONE_ID" -n "$recordset" -v "$token"
+az network dns record-set txt add-record -g "$AZURE_RESOURCE_GROUP" -z "$zone_id" -n "$recordset" -v "$token"
diff --git a/dns_scripts/dns_del_azure b/dns_scripts/dns_del_azure
index 5e103c9..45518c3 100755
--- a/dns_scripts/dns_del_azure
+++ b/dns_scripts/dns_del_azure
@@ -14,7 +14,25 @@ if [[ -z "$AZURE_SUBSCRIPTION_ID" ]]; then
   exit 2
 fi
 
+# Determine which zone ID to use from AZURE_ZONE_IDs
+# Convert the comma-separated list of AZURE_ZONE_IDs into an array and loop
+IFS=',' read -ra zone_ids <<< "$AZURE_ZONE_ID"
+for item in "${zone_ids[@]}"; do 
+  # If the full domain ends with the current zone ID
+  [[ "$fulldomain" =~ .*"${item}"$ ]] && zone_id="$item"
+done
+
+if [ -z "$zone_id" ]; then 
+  echo "${fulldomain} does not match any of the zone IDs specified by ${AZURE_ZONE_ID[@]}"
+  exit 2
+fi
+
 az account set --subscription "$AZURE_SUBSCRIPTION_ID"
-recordset="_acme-challenge.${fulldomain/.$AZURE_ZONE_ID/}"
+# Determine the recordset by removing the zone_id from the full domain and prefixing
+# with _acme-challenge.
+recordset="_acme-challenge.${fulldomain/.$zone_id/}"
+# The fulldomain should not be included in the recordset. It is used for subdomains.
+# E.g. domain = *.sub.example.com the recordset is _acme-challenge.sub
+#      domain = example.com the record set is _acme-challenge
 [[ "$recordset" == "_acme-challenge.$fulldomain" ]] && recordset="_acme-challenge"
-az network dns record-set txt delete --yes -g "$AZURE_RESOURCE_GROUP" -z "$AZURE_ZONE_ID" -n "$recordset"
+az network dns record-set txt delete --yes -g "$AZURE_RESOURCE_GROUP" -z "$zone_id" -n "$recordset"